Credential Files Accessed via Web Shell

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects attempts to access sensitive credential-related files (e.g., configuration files, credential files, .env files, or files containing 'secret') via HTTP requests. This pattern is often associated with web shell activity where an attacker tries to exfiltrate sensitive information from a compromised web server.